System and method for producing test data

ABSTRACT

A system for producing test data produces fuzzing data at least according to first test data which is used for testing at least one first device and second test data which is used for testing a second device. Then, the system transmits the fuzzing data to the second device so as to test the second device.

PRIORITY

This application claims priority to Taiwan Patent Application No.108140848 filed on Nov. 11, 2019, which is hereby incorporated byreference in its entirety.

FIELD

The present disclosure relates to a system and a method for producingtest data. More particularly, the present disclosure relates to a systemand a method for producing diverse test data.

BACKGROUND

Some cyberattacks have evolved from monotonous cyberattacks tomultifaceted cyberattacks. Said monotonous cyberattacks refer to thatthe attacker (or a hacker) attacks one specific device for itsvulnerabilities only, whereas said multifaceted cyberattacks refer tothat the one attacks the device for not only its vulnerabilities butalso other devices' vulnerabilities. Because of lack of test informationof other devices, conventional testing modes against monotonouscyberattacks hardly take effect in multifaceted cyberattacks. Therefore,it is essential to provide a testing mode bearable of multifacetedcyberattacks.

SUMMARY

Provided is a system for producing test data. The system may comprise astorage, a processor electrically connected with the storage, and atransceiver electrically connected with the processor. The storage maybe configured to store first test data for testing at least one firstdevice and second test data for testing a second device. The first testdata and the second test data both conform to a protocol. The processormay be configured to produce fuzzing data at least according to thefirst test data and the second test data. The transceiver may beconfigured to transmit the fuzzing data to the second device so as totest the second device.

Also provided is a method for producing test data. The method maycomprise:

producing fuzzing data by a test data production system at leastaccording to first test data which is used for testing at least onefirst device and second test data which is used for testing a seconddevice; and

transmitting the fuzzing data from the test data production system tothe second device so as to test the second device.

As described above, the fuzzing data used to test the second device isproduced via merging its own second test data and the first test data ofat least one first device. In other words, since the fuzzing dataadditionally includes the first test data for testing the at least onefirst device, the deficiencies of the second test data can becompensated, thereby improving the depth and scope of testing the seconddevice and further increasing diversity of testing the second device.Therefore, compared with the conventional testing modes, a testing modeof using the fuzzing data produced by the system and method forproducing test data of the present disclosure is able to effectivelyresist the multifaceted cyberattacks. The aforesaid content is notintended to limit the present invention, but merely describes thetechnical problems that can be solved by the present invention, thetechnical means that can be adopted, and the technical effects that canbe achieved, so that people having ordinary skill in the art canbasically understand the present invention. People having ordinary skillin the art can understand the various embodiments of the presentinvention according to the attached figures and the content recited inthe following embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawings are provided for describing various embodiments, in which:

FIG. 1 illustrates a system for producing test data according to one ormore embodiments of the present invention;

FIG. 2 illustrates how the system shown in FIG. 1 produces fuzzing data;

FIG. 3A illustrates first test data and second test data according toone or more embodiments of the present invention;

FIG. 3B illustrates how to adjust the first test data according to thesecond test data;

FIG. 3C illustrates the result of merging the first test data and thesecond test data;

FIG. 4 illustrates how the system shown in FIG. 1 adjusts the weights ofthe mutation patterns to produce test data that is more likely to causeabnormal state at a device; and

FIG. 5 illustrates a method for producing test data according to one ormore embodiments of the present invention.

DETAILED DESCRIPTION

The exemplary embodiments described below are not intended to limit thepresent invention to any specific environment, applications, structures,processes or steps as described in these example embodiments. In theattached figures, elements not directly related to the present inventionare omitted from depiction. In the attached figures, dimensionalrelationships among individual elements in the attached drawings aremerely examples but not to limit the actual scale. Unless otherwisedescribed, the same (or similar) element symbols may correspond to thesame (or similar) elements in the following description. Unlessotherwise described, the number of each element described below may beone or more under implementable circumstances.

FIG. 1 illustrates a system for producing test data according to one ormore embodiments of the present invention. The contents shown in FIG. 1are merely for explaining the embodiments of the present inventioninstead of limiting the present invention.

Referring to FIG. 1, a system 11 for producing test data (or a test dataproduction system 11) may communicate with at least one first device 121and a second device 122 (which is the device under test), and producefuzzing data FTD used for testing the second device 122 at leastaccording to first test data TD1 received from the at least one firstdevice 121 and second test data TD2 received from the second device 122.The test data production system 11 may be implemented with a singlephysical computer or multiple physical computers that are mutuallyconnected. The test data production system 11 may basically comprise astorage 111, a processor 112 and a transceiver 113, and the processor112 may be electrically connected with the storage 111 and thetransceiver 113 respectively.

The storage 111 may be configured to store the data produces by the testdata production system 11 or received from the outside of the test dataproduction system 11. For example, the data may include the first testdata TD1 and the second test data TD2. The storage 111 may comprise afirst-level memory (also referred to as main memory or internal memory),and the processor 112 may directly read the instruction set stored inthe first-level memory and execute the instruction sets as needed. Thestorage 111 may optionally comprise a second-level memory (also referredto as an external memory or a secondary memory), and the second-levelmemory may transmit the stored data to the first-level memory throughthe data buffer. For example, the second-level memory may be, but notlimited to, a hard disk, a compact disk, or the like. The storage 111may optionally comprise a third-level memory, that is, a storage devicethat may be directly inserted or removed from a computer, such as aportable hard disk. In some embodiments, the storage 111 may optionallycomprise a cloud storage unit.

The processor 112 may be a microprocessor or a microcontroller having asignal processing function. A microprocessor or microcontroller is aprogrammable special integrated circuit that has the functions ofoperation, storage, output/input, etc., and can accept and processvarious coding instructions, thereby performing various logic operationsand arithmetic operations, and outputting the corresponding operationresult. The processor 112 may be programmed to execute variousoperations or programs in the test data production system 11.

The transceiver 113 may be configured to communicate with the firstdevice(s) 121 and the second device 122 in a wired or a wireless manner,and may comprise a transmitter and a receiver. Taking wirelesscommunication for example, the transceiver 113 may comprise for examplebut not limited to communication elements such as an antenna, anamplifier, a modulator, a demodulator, a detector, an analog-to-digitalconverter, a digital-to-analog converter or the like. Taking wiredcommunication for example, the transceiver 113 may be, but not limitedto, a gigabit Ethernet transceiver, a gigabit interface converter(GBIC), a small form-factor pluggable (SFP) transceiver, a ten gigabitsmall form-factor pluggable (XFP) transceiver, or the like.

FIG. 2 illustrates how the system shown in FIG. 1 produces fuzzing data.The contents shown in FIG. 2 are merely for explaining the embodimentsof the present invention instead of limiting the present invention.

In the present disclosure, the second device 122 is assumed to be thedevice under test unless explained otherwise. Referring to FIG. 2, in aprocess 2 for producing fuzzing data, the processor 112 may firstacquire the first test data TD1 and the second test data TD2 from thestorage 111 (marked as an action 201). The first test data TD1 is thetest data suitable for test testing the first device 121, and the secondtest data TD2 is the test data suitable for testing the second device122. In some embodiments, the first test data TD1 is transmitted to thetransceiver 113 by the first device 121 itself, and the second test dataTD2 is transmitted to the transceiver 113 by the second device 122itself. In some embodiments, the first test data TD1 may be transmittedto the transceiver 113 by other devices than the first device 121, andthe second test data TD2 may be transmitted to the transceiver 113 byother devices than the second device 122. The actions 202-207 may beomitted if there is no need to adjust the first test data TD1, add thirdtest data and mutate the test data, and thus the action 201 is followeddirectly by an action 208. Therefore, in some embodiments, the processor112 may directly merge the first test data TD1 and the second test dataTD2 into fuzzing data FTD, and transmit the fuzzing data FTD to thesecond device 122 for its testing via the transceiver 113.

In some embodiments, the processor 112 may adjust the first test dataTD1 before producing the fuzzing data FTD. This will be furtherdescribed with FIGS. 3A-3C by way of an example, wherein FIG. 3Aillustrates first test data and second test data according to one ormore embodiments of the present invention, FIG. 3B illustrates how toadjust the first test data according to the second test data, and FIG.3C illustrates the result of merging the first test data and the secondtest data. The contents shown in FIGS. 3A-3C are merely for explainingthe embodiments of the present invention instead of limiting the presentinvention.

Referring to FIG. 3A, the first test data TD1 may comprise a pluralityof test sub-data TD1_1, TD1_2, TD1_3, . . . , and the second test dataTD2 may comprise a plurality of test sub-data TD2_1, TD2_2, TD2_3, . . .. The first test data TD1 and the second test data TD2 both conform tothe format of the same protocol, and thus the first test data TD1 andthe second test data TD2 may be respectively divided into a plurality ofblocks corresponding to each other. For example, the first test data TD1and the second test data TD2 may be divided into such blocks as“header”, “payload length”, “topic length”, “topic name”, “message ID”,and “message content” in the case where the first device 121 and thesecond device 122 both conform to the Message Queuing TelemetryTransport (MQTT) protocol.

Further, in the case where the protocol to which the first test data TD1and the second test data TD2 conform is known, the processor 112 maydivide the first test data TD1 into a plurality of first blocks (e.g.,first blocks B11, B12, B13 and B14), and divide the second test data TD2into a plurality of second blocks (e.g., second blocks B21, B22, B23 andB24) corresponding to the first blocks respectively, with a tool such asPyShark. In the case where the protocol to which the first test data TD1and the second test data TD2 conform is unknown, the processor 112 maydivide the first test data TD1 into the first blocks and divide thesecond test data TD2 into the second blocks with a tool such as theNeedleman-Wunsch algorithm.

Although the first test data TD1 and the second test data TD2 conform tothe same protocol, the operating environments and the functions of thefirst device 121 may be different from those of the second device 122,and thus the first test data TD1 may not be as suitable for testing thesecond device 122 as the second test data TD2. Under such circumstances,the processor 112 may determine whether it is necessary to adjust thefirst test data TD1 (marked as an action 202) to make it more suitablefor testing the second device 122 by analyzing the difference rate ofthe data of each block in the second test data TD2.

To be more specific, the processor 112 may calculate block differencerates of the second blocks B21, B22, B23, and B24 in the second testdata TD2 according to the change of the values of the second blocksrespectively. For example, the processor 112 may respectively calculatethe longest common subsequence (LCS) of the second blocks B21, B22, B23,and B24 with the Needleman-Wunsch algorithm, Smith-Waterman algorithm,or Hirschberg's algorithm etc., and then obtain the respective change ofvalues of the second blocks B21, B22, B23, and B24. Taking FIG. 3A as anexample, the block difference rates D1, D2, D3, and D4 of the secondblocks B21, B22, B23, and B24 are 0%, 30%, 40%, and 90% respectively.The block difference rate D1 being 0% indicates that there is nodifference in the content of the data in the second block B21 (e.g., allthe data with the same value of “10”), and the block difference rate D2being 30% indicates that the rate of change in the content of the datain the second block B22 is 30%, and so on.

After obtaining the block difference rates of all of the blocks in thesecond test data TD2, the processor 112 may determine whether any blockdifference rate is lower than a preset threshold to determine whether toadjust the first test data TD1 accordingly. For example, if the presetthreshold is 5%, the processor 112 may adjust the first block B11 in thefirst test data TD1 (marked as the action 203) according to the blockdifference rate D1 being less than the preset threshold (indicating thatthe result of the determination at the action 202 is YES) so as toincrease the acceptance of the first test data TD1 by the second device122. Taking FIG. 3B as an example, the processor 112 may adjust thefirst block B11 to be the same as the content of the second block B21,i.e., the value of “10”. In some embodiments, if the block differencerate D1 of the second block B21 is not 0% (e.g., 3%), the processor 112may adjust the content of the block B11 to the value that has thehighest repetition rate in the second block B21.

After the processor 112 adjusts the first test data TD1, if it is notnecessary to add the third test data and to mutate the test data, theactions 204-207 may be omitted, and the action 203 is followed directlyby the action 208. Therefore, in some embodiments, the processor 112 maymerge the adjusted first test data TD1 and the second test data TD2 intothe fuzzing data FTD after adjusting the first test data TD1. TakingFIG. 3C as an example, the processor 112 may merge the adjusted firsttest data TD1 and the second test data TD2 into a fuzzing data FTDincluding fuzzing sub-data FTD_1, FTD_2, FTD_3, FTD_4, FTD_5, and FTD_6.The transceiver 113 may then transmit the fuzzing data FTD shown in FIG.3C to the second device 122 for its testing.

In some embodiments, the processor 112 may determine whether it isnecessary to add the third test data that conforms to the same protocol(marked as an action 204) to increase the diversity of the test data. Ifthe result of the determination at the action 204 is YES, the processor112 may create a data production model with a machine-learning algorithmbased on the format and content of the second test data TD2 and thefirst test data TD1 obtained from the action 201 or the adjusted firsttest data TD1 obtained from the action 203, and the processor 112 mayuse the data production model to produce the third test data (marked asan action 205). For example, the machine-learning algorithm may be, butnot limited to, a Long Short-Term Memory (LSTM), a Recurrent NeuralNetwork (RNN), and a Deep Neural Network. (DNN) or other algorithmsrelated to deep learning.

After the processor 112 additionally produces the third test data, theactions 206-207 may be omitted if the mutation of the test data is notrequired, and thus the action 205 is followed directly by the action208. Therefore, in some embodiments, the processor 112 may merge thefirst test data TD1 (or the adjusted first test data TD1), the secondtest data TD2, and the third test data into fuzzing data FTD afterproducing the third test data. The transceiver 113 may then transmit thefuzzing data FTD to the second device 122 for its testing.

In some embodiments, the processor 112 may determine whether it isnecessary to mutate the test data (marked as the action 206). If theresult of the determination at the action 206 is “YES”, the test data ismutated (marked as the action 207) to increase the likelihood that thesecond device 122 will experience more abnormal states during the test.In some embodiments, the processor 112 may mutate the first test dataTD1 and the second test data TD2 after acquiring the first test data TD1and the second test data TD2 (i.e., the action 201), and then merge themutated test data into the fuzzing data FTD. In some embodiments, theprocessor 112 may mutate the adjusted first test data TD1 and the secondtest data TD2 after adjusting the first test data TD1 (i.e., the action203), and then merge the mutated test data into the fuzzing data FTD. Insome embodiments, the processor 112 may mutate the second test data TD2,the third test data, and the first test data TD1 (or the adjusted firsttest data TD1) after adding the third test data (i.e., the action 205),and then merge the mutated test data into the fuzzing data FTD. Theprocessor 122 may mutate the test data based on different mutationpatterns, wherein each mutation pattern represents a way of mutation formutating a certain block in the test data, and the way of mutation maybe, for example, a bit mutation, a character mutation or a lengthmutation.

In some embodiments, the processor 122 may also determine the weight ofmutation patterns of the test data based on the result of testing thesecond device 122 at the previous round so as to increase theprobability of choosing those that tend to cause the abnormal states ofthe second device 122 during the test. This will be described with FIG.4 by way of an example. FIG. 4 illustrates how the system shown in FIG.1 adjusts the weights of the mutation patterns to produce test data thatis more likely to cause abnormal state at a device. The contents shownin FIG. 4 are merely for explaining the embodiments of the presentinvention instead of limiting the present invention.

As shown in FIG. 4, it is assumed that there are five mutation patternsM1-M5, and the result of testing the second device 122 at the previousround shows that the mutation pattern M1 caused the abnormal states S1and S2 at the second device 122, the mutation pattern M2 caused theabnormal state S3 at the second device 122, the mutation pattern M3caused the abnormal state S2 and S3 at the second device 122, themutation pattern M4 caused the abnormal state S1 at the second device122, and the mutation pattern M5 caused the abnormal states S1 and S3 atthe second device 122. The abnormal state S1 indicates that the responsetime of the second device 122 is too long, the abnormal state S2indicates that the second device 122 must be rebooted, and the abnormalstate S3 indicates that the connection of the second device 122 must bereset.

Further, in the case where the weights of the mutation patterns are notadjusted, the weights of the mutation patterns M1-M5 are all “1”, so theprobability of choosing any of them are also the same. In order toincrease the probability that the second device 122 will be in anabnormal state, in some embodiments, the processor 122 may adopt themutation strategy A in which the weights of the mutation patterns M1-M5are determined according to the sum of the weights of the abnormalstates S1-S3. In this case, the weights of the mutation patterns M1-M5will be adjusted to “2”, “1”, “2”, “1”, and “2” respectively, therebyincreasing the probability that the second device 122 simultaneouslypresents multiple abnormal states. In some embodiments, the processor122 may adopt the mutation strategy B in which the weights of theabnormal states S1-S3 are modified according to their severity and thenthe weights of the mutation patterns M1-M5 are determined according tothe sum of the adjusted weights of the abnormal states S1-S3. Under suchcircumstances, the weights of the mutation patterns M1-M5 will beadjusted to “9”, “3”, “10”, “2”, and “5” respectively, therebyincreasing not only the probability that the second device 122simultaneously presents multiple abnormal states but also theprobability that the second device 122 falls into a serious abnormalstate. In other embodiments, the processor 122 may also adopt othermutation strategies to adjust the weights of the mutation patternsM1-M5, and is not limited to adopt the mutation strategy A and themutation strategy B shown in FIG. 4.

In some embodiments, the second device 122 may return its test resultsand/or its test data to the test data production system 11 after it hascompleted the test. Those will be a reference for the test dataproduction system 11 to produce test data next time.

FIG. 5 illustrates a method for producing test data according to one ormore embodiments of the present invention. The contents shown in FIG. 5are merely for explaining the embodiments of the present inventioninstead of limiting the present invention.

Referring to FIG. 5, a method 5 for producing test data may comprise thefollowing steps:

producing fuzzing data by a test data production system at leastaccording to first test data which is used for testing at least onefirst device and second test data which is used for testing a seconddevice, wherein the first test data and the second test data bothconform to a protocol (marked as step 501); and

transmitting the fuzzing data from the test data production system tothe second device so as to test the second device (marked as step 502).

In some embodiments, the method 5 for producing the test data mayfurther comprise the following steps:

the test data production system receiving the first test data from theat least one first device; and

the test data production system receiving the second test data from thesecond device.

In some embodiments, the method 5 for producing the test data mayfurther comprise the following step: merging the first test data and thesecond test data by the test data production system so as to produce thefuzzing data.

In some embodiments, the method 5 for producing the test data mayfurther comprise the following steps:

producing third test data conforming to the protocol by the test dataproduction system based on the first test data and the second test datavia a machine-learning model; and

merging the first test data, the second test data and the third testdata by the test data production system so as to produce the fuzzingdata.

In some embodiments, the method 5 for producing the test data mayfurther comprise the following steps:

mutating the first test data and the second test data by the test dataproduction system; and

merging the mutated first test data and the mutated second test data bythe test data production system so as to produce the fuzzing data. Inthese embodiments, optionally, the method 5 for producing the test datamay further comprise the following step: determining weights of mutationpatterns of the first test data and the second test data by the testdata production system according to a result of testing the seconddevice at a previous round.

In some embodiments, the method 5 for producing the test data mayfurther comprise the following steps:

dividing the first test data into a plurality of first blocks by thetest data production system;

dividing the second test data into a plurality of second blocks whichcorrespond to the first blocks respectively, and calculating a rate ofdifference of each second block, by the test data production system;

adjusting content of one or more first blocks by the test dataproduction system according to that of the corresponding second block(s)to produce adjusted first test data, as the rate of difference of thecorresponding second block(s) is lower than a preset threshold; and

merging at least the adjusted first test data and the second test databy the test data production system so as to produce the fuzzing data.

In some embodiments, the method 5 for producing the test data mayfurther comprise the following steps:

dividing the first test data into a plurality of first blocks by thetest data production system;

dividing the second test data into a plurality of second blocks whichcorrespond to the first blocks respectively, and calculating a rate ofdifference of each second block, by the test data production system;

adjusting content of one or more first blocks by the test dataproduction system according to that of the corresponding second block(s)to produce adjusted first test data, as the rate of difference of thecorresponding second block(s) is lower than a preset threshold;

producing third test data conforming to the protocol by the test dataproduction system based on the adjusted first test data and the secondtest data via a machine-learning model; and

merging the adjusted first test data, the second test data and the thirdtest data by the test data production system so as to produce thefuzzing data.

In some embodiments, the method 5 for producing test data may furthercomprise the following steps:

dividing the first test data into a plurality of first blocks by thetest data production system;

dividing the second test data into a plurality of second blocks whichcorrespond to the first blocks respectively, and calculating a rate ofdifference of each second block, by the test data production system;

adjusting content of one or more first blocks by the test dataproduction system according to that of the corresponding second block(s)to produce adjusted first test data, as the rate of difference of thecorresponding second block(s) is lower than a preset threshold;

mutating the adjusted first test data and the second test data by thetest data production system; and

merging the mutated first test data and the mutated second test data bythe test data production system so as to produce the fuzzing data. Inthese embodiments, optionally, the method 5 for producing the test datamay further comprise the following step: determining weights of mutationpatterns of the adjusted first test data and the second test data by thetest data production system according to a result of testing the seconddevice at a previous round.

In addition to the aforesaid embodiments, there are other embodiments ofthe method 5 of producing the test data which correspond to those of thetest data production system 11. These embodiment of the method 5 ofproducing the test data which are not mentioned specifically can bedirectly understood by people having ordinary skill in the art based onthe aforesaid descriptions for the test data production system 11, andwill not be further described herein.

The above disclosure is related to the detailed technical contents andinventive features thereof. People of ordinary skill in the art mayproceed with a variety of modifications and replacements based on thedisclosures and suggestions of the invention as described withoutdeparting from the characteristics thereof. Nevertheless, although suchmodifications and replacements are not fully disclosed in the abovedescriptions, they have substantially been covered in the followingclaims as appended.

What is claimed is:
 1. A system for producing test data, comprising: astorage, configured to store first test data for testing capability ofat least one first device against cyberattacks and second test data fortesting capability of a second device against cyberattacks, wherein thefirst test data and the second test data both conform to a protocol, thefirst test data and the second test data both comprise a plurality oftest sub-data; a processor electrically connected with the storage,configured to: divide the first test data into a plurality of firstblocks, wherein each of the first blocks comprises a portion of eachtest sub-data; divide the second test data into a plurality of secondblocks which correspond to the first blocks respectively, and calculatesa rate of difference of each second block, wherein the rate ofdifference of each second block is calculated by analyzing a change ofvalues of the test sub-data of each block in the second test data;adjust content of one or more first blocks according to that ofcorresponding second block(s) respectively to produce adjusted firsttest data, as the rate of difference of the corresponding secondblock(s) is lower than a preset threshold; and merge at least theadjusted first test data and the second test data so as to producefuzzing data; a transceiver electrically connected with the processor,configured to transmit the fuzzing data to the second device so as totest the second device with the fuzzing data in a testing mode againstmultifaceted cyberattacks.
 2. The system for producing the test data ofclaim 1, wherein the first test data is transmitted from the at leastone first device to the transceiver, and the second test data istransmitted from the second device to the transceiver.
 3. The system forproducing the test data of claim 1, wherein the processor is furtherconfigured to: mutate the first test data and the second test data; andmerge the mutated first test data and the mutated second test data so asto produce the fuzzing data.
 4. The system for producing the test dataof claim 1, wherein the processor is further configured to determineweights of mutation patterns of the first test data and the second testdata according to a result of testing the second device at a previousround.
 5. The system for producing the test data of claim 1, wherein thethird test data is produced based on the adjusted first test data andthe second test data via the machine-learning model, and the processormerges the adjusted first test data, the second test data and the thirdtest data so as to produce the fuzzing data.
 6. The system for producingthe test data of claim 1, wherein the processor is further configuredto: divide the first test data into a plurality of first blocks; dividethe second test data into a plurality of second blocks which correspondto the first blocks respectively, and calculates a rate of difference ofeach second block; adjust content of one or more first blocks accordingto that of corresponding second block(s) to produce adjusted first testdata, as the rate of difference of the corresponding second block(s) islower than a preset threshold; mutate the adjusted first test data andthe second test data; and merge the mutated first test data and themutated second test data so as to produce the fuzzing data.
 7. Thesystem for producing the test data of claim 6, wherein the processor isfurther configured to determine weights of mutation patterns of theadjusted first test data and the second test data according to a resultof testing the second device at a previous round.
 8. A method forproducing test data, comprising: dividing first test data into aplurality of first blocks by a test data production system, wherein thefirst test data and second test data comprise a plurality of testsub-data, and each of the first blocks comprises a portion of each testsub-data; dividing the second test data into a plurality of secondblocks which correspond to the first blocks respectively, andcalculating a rate of difference of each second block, by the test dataproduction system, wherein the rate of difference of each second blockis calculated by analyzing a difference rate of the test sub-data ofeach block in the second test data; adjusting content of one or morefirst blocks by the test data production system according to that ofcorresponding second block(s) to produce adjusted first test data, asthe rate of difference of the corresponding second block(s) is lowerthan a preset threshold; merging at least the adjusted first test dataand the second test data by the test data production system so as toproduce fuzzing data; and transmitting the fuzzing data from the testdata production system to the second device so as to test the seconddevice with the fuzzing data in a testing mode against multifacetedcyberattacks.
 9. The method for producing the test data of claim 8,further comprising: the test data production system receiving the firsttest data from the at least one first device; and the test dataproduction system receiving the second test data from the second device.10. The method for producing the test data of claim 8, furthercomprising: mutating the first test data and the second test data by thetest data production system; and merging the mutated first test data andthe mutated second test data by the test data production system so as toproduce the fuzzing data.
 11. The method for producing the test data ofclaim 8, further comprising: determining weights of mutation patterns ofthe first test data and the second test data by the test data productionsystem according to a result of testing the second device at a previousround.
 12. The method for producing the test data of claim 8, whereinthe third test data is produced based on the adjusted first test dataand the second test data via the machine-learning model, and the methodfor producing the test data further comprises: merging the adjustedfirst test data, the second test data and the third test data by thetest data production system so as to produce the fuzzing data.
 13. Themethod for producing the test data of claim 8, further comprising:dividing the first test data into a plurality of first blocks by thetest data production system; dividing the second test data into aplurality of second blocks which correspond to the first blocksrespectively, and calculating a rate of difference of each second block,by the test data production system; adjusting content of one or morefirst blocks by the test data production system according to that ofcorresponding second block(s) to produce adjusted first test data, asthe rate of difference of the corresponding second block(s) is lowerthan a preset threshold; mutating the adjusted first test data and thesecond test data by the test data production system; and merging themutated first test data and the mutated second test data by the testdata production system so as to produce the fuzzing data.
 14. The methodfor producing the test data of claim 13, further comprising: determiningweights of mutation patterns of the adjusted first test data and thesecond test data by the test data production system according to aresult of testing the second device at a previous round.